India’s Enforcement Directorate searched premises linked to Mudrex and Instadapp in a cross-border crypto investigation exceeding ₹5,000 crore ($525 million), while wallets tied to the suspected Binance hack used DeFi protocols to shift frozen stablecoin value into ETH.
The ED said its Bengaluru Zonal Office carried out searches on Oct. 27 at three locations in Bengaluru and one in Madhya Pradesh under the Foreign Exchange Management Act. Investigators alleged that RPFAS Technologies, which operates Mudrex and Saber.money, used USDT and USDC stablecoins to move money across borders outside authorized remittance channels. The agency put preliminary unauthorized transfers and overseas crypto balances at more than ₹4,600 crore, and said related entities were incorporated in Canada, Lithuania and the United States, with transactions on Binance and Bybit.
In a separate finding, the ED alleged that Instadapp’s overseas companies lacked real offices or employees and were used to route income to India. Protocol revenue and investor funding were received as stablecoins in multisignature wallets controlled from India, sold through Independent Reserve Singapore and QCP Capital Singapore, and remitted to India as payments for “bogus software development and consultancy fees.” The preliminary Instadapp-related FEMA estimate was about $40 million. No arrests or penalties were announced.
Meanwhile, on-chain data showed the suspected Binance attacker receiving tens of thousands of ETH from Uniswap contracts and borrowing 19,762 ETH on Aave against roughly $60 million in USDT. More than $5.5 billion was drained from exchange wallets, according to security experts. Tether and Circle blacklisted suspected addresses, freezing more than $2 billion in USDT and USDC, while Ripple froze about $200 million in RLUSD. Because ETH has no issuer that can freeze it, every conversion before a freeze moved funds beyond centralized control. Aave froze its Ethereum mainnet V3 markets, and Kamino paused borrowing in its Solana and Bitcoin markets as a precaution. By 22:07 UTC, about 253,000 ETH, or roughly $570 million, sat in two labeled exploiter wallets with no outgoing transfers.
Tornado Cash appeared only as funding for the setup address, while Monero rose about 6%, suggesting some traders expected privacy-coin rotation.
